JP2008123065A - Detection method for image scan type spyware - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method for preventing damage by detecting spyware which is trying to perform illegal image scanning unintended by a user even when a virus pattern file is not acquired. <P>SOLUTION: A computer is provided with an image scan operation/detection means for detecting an operation to scan a display image; and an image scanning warning level list table in which process-categorized warning content for image scanning are registered. When the image scanning operation is detected by the image scanning operation/detection means of the computer, it is collated with the image scanning warning level list table, and warning is issued by the level-categorized designated warning method. When the image scanning operation is detected by the image scanning operation/detection means of the computer, warning is issued by any warning method of not issuing warning in accordance with the preliminarily set security level, displaying only the fact that the image scanning operation has been detected on a picture, and displaying the same image as the scanned image on the picture as a reduced image. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an image scanning spyware detection method, and in particular, by providing an image scanning operation / detecting means for detecting an operation of scanning a display image, an unauthorized image scanning other than a previously permitted means is detected. On how to do.

  Conventionally, as a method of preventing damage caused by spyware that illegally scans an image, a method of obtaining a virus pattern file and searching for software that matches the pattern is known.

As described above, conventionally, as a method for preventing damage caused by spyware that illegally scans an image, a method of obtaining a virus pattern file and searching for software that matches the pattern is known.
However, this method has a problem that new spyware cannot be detected until it is reflected in the pattern file.
The present invention has been made to solve the above-described problems of the prior art, and an object of the present invention is to perform an unauthorized image scan unintended by the user without acquiring a virus pattern file. It is to provide a method for detecting spyware and preventing damage. The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
In order to achieve the above-mentioned object, the present invention provides an image scanning spyware detection method that detects an image scanning spyware that has entered a computer and issues a warning, and the computer scans a display image. An image scan operation / detection means for detecting the image and an image scan warning level list in which the warning contents for the image scan for each process are registered in advance, and the image scan operation / detection means of the computer performs the image scan operation. When it is detected, it is compared with the image scan warning level list, and a warning is issued by a warning method specified for each level.
In the present invention, when the image scanning operation / detection unit of the computer detects an image scanning operation, it does not notify a warning or displays only that there is a detection according to a preset security level. The warning is issued by any one of the warning methods of whether the same image as the scanned image is displayed on the screen as a reduced image.

The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
According to the present invention, it is possible to detect spyware that attempts to perform unauthorized image scanning that is not intended by the user without acquiring a virus pattern file, thereby preventing damage.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In all the drawings for explaining the embodiments, parts having the same functions are given the same reference numerals, and repeated explanation thereof is omitted.
FIG. 1 is a functional relation diagram of an image scanning spyware detection method according to an embodiment of the present invention. In FIG. 1, 101 is a warning policy setting function, 102 is an image scan warning level list database, 103 is a warning policy database, 104 is an image scan warning level list search function, 105 is a warning display function, and 106 is an image scan detection. Indicates function.
FIG. 7 is a block diagram showing a hardware configuration of a personal computer (hereinafter referred to as PC) in which the image scanning spyware detection method according to the embodiment of the present invention is executed.
7, 701 is a screen display device, 702 is a PC main unit, 703 is a control unit, 704 is a calculation unit, 705 is a main storage unit (RAM), 706 is an auxiliary storage unit (HDD), 707 is a power supply unit, and 708. Indicates a keyboard, 709 indicates a mouse, 710 indicates a communication control device, and 711 indicates a communication line.
The control unit 703 in FIG. 7 executes the warning policy setting function 101, the image scan warning level list search function 104, the warning display function 105, and the image scan detection function 106 in FIG.
The image scan warning level list database 102 and the warning policy database 103 in FIG. 1 are stored in the auxiliary storage unit 706 in FIG.

The image scanning spyware detection method of this embodiment will be described below.
First, a method for detecting a process performing image scanning will be described.
The warning policy setting function 101 in FIG. 1 sets warning methods for each level and sets them in the warning policy database 103. When the setting of the warning policy database is completed, the image scan detection function 106 can be used.
FIG. 2 is a flowchart showing a processing procedure of the image scan detection function 106 of FIG.
The image scan detection function 106 in FIG. 1 monitors whether or not there is an image scan for all active processes (step 201). This step is performed until an instruction to end monitoring is given (step 205).
As an example of the specific processing in step 201, the information to be displayed is stored in the display image memory area (VRAM), so that the display processing of all images is executed at all times. The activated image scan detection function 106 is a process for monitoring the PC control unit 703 for a process that requests to read into the VRAM.
If an image scan is detected in step 201, the process that performed the image scan is specified (step 202), and the image scan warning level list is searched based on the process information (step 203). A corresponding warning is displayed, and image scan monitoring is performed again (step 204).

FIG. 3 is a flowchart showing a processing procedure of the image scan warning level list search function 104 of FIG.
The image scan warning level list search function 104 shown in FIG. 1 acquires process information detected by the image scan detection function 106 (step 301), and stores the image scan warning level list database 102 with the process information. A search is performed (step 302), and the search result is returned to the image scan detection function 106.
Next, a method for displaying a warning with the warning display function 105 of FIG. 1 will be described.
FIG. 4A and FIG. 4B are flowcharts showing the processing procedure of the warning display function 105 of FIG.
The warning display function 105 in FIG. 1 acquires the search result acquired by the image scan warning level list search function 104 in FIG. 1 (step 401), and the image scan warning level list database 102 has information on the process. (Step 402).
If the process does not exist in the image scan warning level list database 102 in step 402, the warning level is set to the highest level (step 404).
In step 402, if the process exists in the image scan warning level list database 102, the warning level is set with the contents set in the image scan warning level list database 102.

When the warning level is determined, a warning method for the warning level is acquired from the warning policy database 103 (step 405), and it is determined whether or not a warning is issued (step 406). If no warning is issued in step 406, the warning display function is terminated.
If a warning is to be issued in step 406, it is determined whether or not to issue a warning for the reduced image (step 407). In step 407, when a warning is issued with a reduced image, an image obtained by reducing the same image as that scanned by the process is created (step 408).
Whether a warning is issued with a reduced image in step 407 or a warning is not issued with a reduced image in step 407, a warning window is displayed with a warning sound on the forefront of the PC (step 409).
At this time, when the reduced image is not used, a warning window not using the reduced image shown in FIG. 5 is displayed, and when the reduced image is used, a warning window using the reduced image of FIG. 6 is displayed.
FIG. 5 shows a warning window layout that does not use a reduced image. In the figure, 501 is a window frame of the warning window, 502 is a process information display unit that has scanned an image, and 503 suppresses warning display from the next time. An operation button for designating, 504 indicates an explanation display section of the operation button.
FIG. 6 shows a warning window layout using a reduced image. In the figure, 601 is a window frame of the warning window, 602 is a process information display unit that has scanned an image, and 603 suppresses warning display from the next time. An operation button for designating, 604 an operation button description display section, and 605 a reduced image display section.

Next, it is determined whether there is a user response to the warning (step 410). If there is no user response to the warning in step 410, it is determined whether a certain time has passed (step 411). If it is determined in step 411 that a certain time has elapsed, the warning window is deleted (step 413).
Also, in step 410, if the user response to the warning, that is, the operation button for specifying the warning display in the warning window is pressed, does the user request not to display the warning next time? After obtaining the information (step 412), the warning window is deleted (step 413).
After the warning window is erased, it is determined whether or not to display a warning from the next time (step 414). In step 414, if the warning is displayed from the next time, the process is terminated.
In step 414, if warning display is not performed after the next time, information related to the process in the image scan warning level list database 102 is updated (step 415), and the process is terminated.
As described above, according to the present embodiment, when a process in the PC performs an image scan, the image scan detection function 106 detects the process and matches the warning level set in the image scan warning level list database 102. Since the user is notified by a warning method, the user can detect an image scan by a process not intended by the user.
As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a function related figure of the detection method of the image scanning spyware of the Example of this invention. It is a flowchart which shows the process sequence of the image scan detection function of FIG. 3 is a flowchart showing a processing procedure of a search function of an image scan warning level list in FIG. 1. It is a flowchart which shows the process sequence of the warning display function of FIG. It is a flowchart which shows the process sequence of the warning display function of FIG. It is a figure explaining the warning window which does not use a reduction image warned by the warning display function of FIG. It is a figure explaining the warning window using a reduced image warned by the warning display function of FIG. It is a block diagram which shows the hardware constitutions of the personal computer with which the detection method of the image scanning type spyware of the Example of this invention is performed.

Explanation of symbols

101 Warning Policy Setting Function 102 Image Scan Warning Level List Database 103 Warning Policy Database 104 Image Scan Warning Level List Search Function 105 Warning Display Function 106 Image Scan Detection Function 501, 601 Window frame of warning window 502, 602 Performed process information display unit 503, 603 Operation buttons 504, 604 Explanation display unit for operation button 605 Reduced image display unit 701 Screen display device 702 PC main unit 703 Control unit 704 Calculation unit 705 Main memory (RAM)
706 Auxiliary storage unit (HDD)
707 Power supply unit 708 Keyboard 709 Mouse 710 Communication control unit 711 Communication line

Claims (2)

An image scanning spyware detection method that detects image scanning spyware that has entered a computer and issues a warning.
An image scanning operation / detecting means for detecting an operation of scanning a display image in the computer;
An image scanning warning level list in which warning contents for image scanning by process are registered in advance, and
When the image scanning operation / detection means of the computer detects an image scanning operation, the image scanning operation is compared with the image scanning warning level list, and a warning is issued by a warning method specified for each level. Type spyware detection method.   When the image scanning operation / detection means of the computer detects an image scanning operation, it does not notify a warning or displays on the screen only that there is a detection, or has been scanned according to a preset security level. 2. The image scanning spyware detection method according to claim 1, wherein the warning is issued by any one of the warning methods of displaying the same image as the reduced image on the screen.

Images